skills.rest
wgpsec
wgpsecOFFICIAL
Explore all skills by this author →
Website𝕏@wgpsecGitHub

ctf-web-recon

Enumerate hidden files, endpoints, and source leaks in CTF web applications.

1.6k|234|Updated Dec 7, 2019
Search Tags:#ctf#web-recon#recon#js-analysis#source-leak#backup-files#tech-fingerprinting
One-click install
npx skills add https://github.com/wgpsec/AboutSecurity --skill ctf-web-recon
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: ctf-web-recon
Source: https://github.com/wgpsec/AboutSecurity/tree/main/skills/ctf/ctf-web-recon
Command: npx skills add https://github.com/wgpsec/AboutSecurity --skill ctf-web-recon

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Provides a focused, time-boxed reconnaissance methodology for CTF web challenges to quickly surface hidden endpoints, leaked source, and backup files so players can move to exploitation within a few rounds rather than performing broad asset enumeration.

Core Features & Use Cases

  • Homepage triage: Inspect response headers, cookies, and HTML comments to extract hints about technology and potential entry points.
  • Key path enumeration: Prioritized checks for robots.txt, .git leaks, common backup files, admin/login paths, and other high-value files.
  • JavaScript and tech fingerprinting: Fetch and scan referenced JS for API endpoints, hard-coded secrets, and framework indicators to guide targeted attacks.
  • Use Case: In a CTF web challenge, run the 2–3 round recon sequence to quickly find a backup archive or .git leak that contains source revealing an exploitable endpoint.

Quick Start

Inspect the target homepage, fetch robots.txt and .git/HEAD, and scan referenced JavaScript and common backup paths to list likely hidden endpoints and source leaks.

Frequently Asked Questions about ctf-web-recon

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find hidden endpoints and source leaks in CTF web challenges quickly?▼

To find hidden endpoints and source leaks in CTF web challenges quickly, run a 2-3 round reconnaissance sequence that inspects HTTP headers, HTML comments, robots.txt, .git leaks, and JavaScript files to locate backup files and exposed API paths.

What is the best way to scan JavaScript files for hard-coded secrets and API endpoints?▼

The best way to scan JavaScript files for hard-coded secrets and API endpoints is to fetch and analyze referenced JS files during web recon, extracting framework indicators and exposed routes to guide targeted attacks.

How do I check for .git leaks and common backup files during web reconnaissance?▼

To check for .git leaks and common backup files during web reconnaissance, perform prioritized path enumeration by fetching .git/HEAD and testing high-value backup archive paths to recover leaked source code.

Can I use this web recon approach for broad asset enumeration across multiple targets?▼

No, this web recon approach is not designed for broad asset enumeration across multiple targets. It is a focused, time-boxed methodology strictly for single-target CTF web applications to quickly surface hidden clues within a few rounds.

What technology fingerprinting techniques work for identifying CTF web application frameworks?▼

Technology fingerprinting for identifying CTF web application frameworks involves inspecting response headers, cookies, and HTML comments, combined with scanning JavaScript for framework indicators to guide targeted attacks.

Why should I inspect HTML comments and robots.txt first in CTF web recon?▼

You should inspect HTML comments and robots.txt first in CTF web recon because they provide immediate homepage triage hints, revealing hidden entry points, restricted paths, and potential technology stacks for further enumeration.

Related Skills

Explore More Software Engineering Skills→
ersinkocersinkoc
2

Web Application Fingerprinting

Identify website technologies via HTTP headers and HTML analysis.

Community
Intermediate
sergicalsergical
1

gha-security-review

Audit GitHub Actions workflows for exploitable security vulnerabilities.

Community
Advanced
AeonDaveAeonDave
15

gobuster

Enumerate directories, DNS subdomains, and virtual hosts on web servers.

Community
Intermediate
ArianHobson333ArianHobson333
7

reconnaissance

Identify subdomains, ports, endpoints, APIs, and attack surfaces.

Community
Advanced